Difficulties of identifying application type in backbone traffic

A flow identification in backbone traffic is a crucial problem for network management to provide better service to the users. However, application traffic on backbone is in general hard to be identified because of the amount of traffic volume, asymmetric nature of the route, and difficulty of capturing full payload. In this paper, we present our preliminary results of the basic ability and limitation of four well-known flow identification algorithms (port-based heuristics and payload-based one) applied to packet trace called MAWI trace measured at a trans-pacific link. First, we show that the identification ratio of the payload-based algorithms is 40-60% in flow level, however the accuracy of the identification in the payload-based algorithms strongly depends on the algorithm and the definition of the rules themselves. Next, we found that only 3% of the traffic is commonly identified by the payload-based algorithms when we apply them to unknown traffic reported by the port-based heuristics. Finally, we evaluate the dependency of the flow size on the identification ratio. Those results emphasize the need for a more accurate and available identification algorithm.